FKIE_CVE-2026-49755

Vulnerability from fkie_nvd - Published: 2026-06-08 16:16 - Updated: 2026-08-18 15:46
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound. Both steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req's automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process. This issue affects req: from 0.1.0 before 0.6.1.
References
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://cna.erlef.org/cves/CVE-2026-49755.htmlThird Party Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8dPatch
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gvVendor Advisory, Exploit, Patch
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://osv.dev/vulnerability/EEF-CVE-2026-49755Third Party Advisory, Patch, Mitigation
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gvVendor Advisory, Exploit, Patch
Impacted products
Vendor Product Version
wojtekmach req *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Req.Steps\u0027"
          ],
          "packageName": "req",
          "packageURL": "pkg:hex/req",
          "product": "req",
          "programFiles": [
            "lib/req/steps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Req.Steps\u0027:decode_body/1"
            },
            {
              "name": "\u0027Elixir.Req.Steps\u0027:decompress_body/1"
            }
          ],
          "repo": "https://github.com/wojtekmach/req",
          "vendor": "wojtekmach",
          "versions": [
            {
              "lessThan": "0.6.1",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Req.Steps\u0027"
          ],
          "packageName": "wojtekmach/req",
          "packageURL": "pkg:github/wojtekmach/req",
          "product": "req",
          "programFiles": [
            "lib/req/steps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Req.Steps\u0027:decode_body/1"
            },
            {
              "name": "\u0027Elixir.Req.Steps\u0027:decompress_body/1"
            }
          ],
          "repo": "https://github.com/wojtekmach/req.git",
          "vendor": "wojtekmach",
          "versions": [
            {
              "lessThan": "84977e5b1a83f26e749d55ad06e3625464af4e8d",
              "status": "affected",
              "version": "e37753741cbdc725e6aba3d977b380163bfc0ecb",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C85D450B-D8C8-46E9-8AEC-6DBAECE8CAF4",
              "versionEndExcluding": "0.6.1",
              "versionStartIncluding": "0.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies.\n\nReq\u0027s default response pipeline includes Req.Steps.decode_body/1 and Req.Steps.decompress_body/1 in lib/req/steps.ex. decode_body/1 dispatches on the server-supplied content-type (or URL extension) and calls :zip.extract(body, [:memory]) for application/zip, :erl_tar.extract({:binary, body}, [:memory]) for application/x-tar, and :erl_tar.extract({:binary, body}, [:memory, :compressed]) for application/gzip / .tgz. Each returns the full decompressed archive contents as a [{name, bytes}] list in memory, with no per-entry or total size cap. decompress_body/1 walks the content-encoding header and chains :zlib/:brotli/:ezstd decoders, so a response advertising content-encoding: gzip, gzip, gzip inflates through multiple layers without bound.\n\nBoth steps are enabled by default, no caller opt-in is required, and the attacker controls the content-type and content-encoding headers on their own server (or on any host reached via Req\u0027s automatic redirect following). A sub-megabyte response can expand to multiple gigabytes on the victim, crashing the BEAM process.\n\nThis issue affects req: from 0.1.0 before 0.6.1."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de manejo inadecuado de datos altamente comprimidos (amplificaci\u00f3n de datos) en wojtekmach Req permite a los servidores HTTP controlados por el atacante agotar la memoria en un cliente Req mediante cuerpos de respuesta de bomba de descompresi\u00f3n.\n\nLa pipeline de respuesta predeterminada de Req incluye Req.Steps.decode_body/1 y Req.Steps.decompress_body/1 en lib/req/steps.ex. decode_body/1 despacha seg\u00fan el content-type proporcionado por el servidor (o extensi\u00f3n de URL) y llama a :zip.extract(body, [:memory]) para application/zip, a :erl_tar.extract({:binary, body}, [:memory]) para application/x-tar, y a :erl_tar.extract({:binary, body}, [:memory, :compressed]) para application/gzip / .tgz. Cada uno devuelve el contenido completo del archivo descomprimido como una lista [{name, bytes}] en memoria, sin l\u00edmite de tama\u00f1o por entrada o total. decompress_body/1 recorre el encabezado content-encoding y encadena decodificadores :zlib/:brotli/:ezstd, por lo que una respuesta que anuncia content-encoding: gzip, gzip, gzip se infla a trav\u00e9s de m\u00faltiples capas sin l\u00edmite.\n\nAmbos pasos est\u00e1n habilitados por defecto, no se requiere la participaci\u00f3n del llamador, y el atacante controla los encabezados content-type y content-encoding en su propio servidor (o en cualquier host alcanzado a trav\u00e9s del seguimiento autom\u00e1tico de redirecciones de Req). Una respuesta de menos de un megabyte puede expandirse a m\u00faltiples gigabytes en la v\u00edctima, colapsando el proceso BEAM.\n\nEste problema afecta a req: desde 0.1.0 antes de 0.6.1."
    }
  ],
  "id": "CVE-2026-49755",
  "lastModified": "2026-08-18T15:46:34.387",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49755",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-08T16:49:57.977214Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-08T16:16:43.860",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-49755.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/wojtekmach/req/commit/84977e5b1a83f26e749d55ad06e3625464af4e8d"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory",
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory",
        "Patch",
        "Mitigation"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49755"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory",
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-409"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.